Refusal-subspace dimensionality for full suppression scales with model size

Winninger trains a Recursive Feature Machine refusal classifier on Qwen3 (1.7B-14B) and Qwen2.5-7B-Instruct activations, taking the top-k eigenvectors of its Average Gradient Outer Product as a refusal subspace [winninger-2026-fast-multi-dimensional-refusal-subspaces-via-rfm-agop] Cumulative ablation raises attack-success rate monotonically with the number of ablated dimensions, and the count needed to cross 50% scales with model size: k=1 suffices for smaller models while Qwen3-8B and 14B need 3 or more [winninger-2026-fast-multi-dimensional-refusal-subspaces-via-rfm-agop] Steering along the top eigenvector alone induces refusal, with lower-ranked eigenvectors progressively less effective, and matched-rank random-direction controls confirm the effect is not from ablating an arbitrary subspace [winninger-2026-fast-multi-dimensional-refusal-subspaces-via-rfm-agop]